diff --git a/.github/workflows/lock-threads.yaml b/.github/workflows/lock-threads.yaml
index 8a513d690..cefcc8594 100644
--- a/.github/workflows/lock-threads.yaml
+++ b/.github/workflows/lock-threads.yaml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-24.04 # https://github.com/actions/runner-images
     steps:
       - name: Lock threads after 30 days of inactivity
-        uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # https://github.com/dessant/lock-threads/releases/tag/v5.0.1
+        uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # https://github.com/dessant/lock-threads/releases/tag/v6.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           issue-inactive-days: 30
diff --git a/.github/workflows/stale-threads.yaml b/.github/workflows/stale-threads.yaml
index 729b6fa1d..695d400aa 100644
--- a/.github/workflows/stale-threads.yaml
+++ b/.github/workflows/stale-threads.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04 # https://github.com/actions/runner-images
     steps:
       - name: Manage stale threads (Issues & PRs)
-        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # https://github.com/actions/stale/releases/tag/v10.1.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # https://github.com/actions/stale/releases/tag/v10.2.0
         with:
           stale-issue-message: |
             This issue has been marked as stale due to inactivity. It will be automatically closed in 7 days if no update is received.
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 92fb9098c..ae9f3b814 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -18,14 +18,14 @@ jobs:
     runs-on: ubuntu-24.04 # https://github.com/actions/runner-images
     steps:
       - name: Checkout code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # https://github.com/actions/checkout/releases/tag/v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # https://github.com/actions/checkout/releases/tag/v6.0.2
         with:
           persist-credentials: false
 
       - name: Setup PHP 8.5
         uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # https://github.com/shivammathur/setup-php/releases/tag/2.36.0
         with:
-          php-version: "8.5.0" # https://github.com/php/php-src/releases/tag/php-8.5.0
+          php-version: "8.5.3" # https://github.com/php/php-src/releases/tag/php-8.5.3
 
       - name: Validate composer.json
         run: composer validate --check-lock --strict
@@ -36,18 +36,18 @@ jobs:
     needs: [composer-validate]
     steps:
       - name: Checkout code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # https://github.com/actions/checkout/releases/tag/v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # https://github.com/actions/checkout/releases/tag/v6.0.2
         with:
           persist-credentials: false
 
       - name: Setup PHP 8.5
         uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # https://github.com/shivammathur/setup-php/releases/tag/2.36.0
         with:
-          php-version: "8.5.0" # https://github.com/php/php-src/releases/tag/php-8.5.0
+          php-version: "8.5.3" # https://github.com/php/php-src/releases/tag/php-8.5.3
 
       - name: Cache Composer packages
         id: composer-cache
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # https://github.com/actions/cache/releases/tag/v4.3.0
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # https://github.com/actions/cache/releases/tag/v5.0.3
         with:
           path: /vendor
           key: php-${{ hashFiles('composer.lock') }}
@@ -65,14 +65,14 @@ jobs:
     needs: [composer-validate]
     steps:
       - name: Checkout code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # https://github.com/actions/checkout/releases/tag/v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # https://github.com/actions/checkout/releases/tag/v6.0.2
         with:
           persist-credentials: false
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # https://github.com/oven-sh/setup-bun/releases/tag/v2.0.2
+        uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # https://github.com/oven-sh/setup-bun/releases/tag/v2.1.2
         with:
-          bun-version: 1.3.3 # https://github.com/oven-sh/bun/releases/tag/bun-v1.3.3
+          bun-version: 1.3.9 # https://github.com/oven-sh/bun/releases/tag/bun-v1.3.9
       - name: Run Bun audit
         run: bun audit --frozen-lockfile
 
@@ -82,19 +82,18 @@ jobs:
     needs: [composer-audit, bun-audit]
     steps:
       - name: Checkout code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # https://github.com/actions/checkout/releases/tag/v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # https://github.com/actions/checkout/releases/tag/v6.0.2
         with:
           persist-credentials: false
 
       - name: Setup PHP 8.5 with Xdebug
         uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # https://github.com/shivammathur/setup-php/releases/tag/2.36.0
         with:
-          php-version: "8.5.0" # https://github.com/php/php-src/releases/tag/php-8.5.0
-          coverage: xdebug-3.5.0 # https://github.com/xdebug/xdebug/releases/tag/3.5.0
-
+          php-version: "8.5.3" # https://github.com/php/php-src/releases/tag/php-8.5.3
+          coverage: xdebug-3.5.1 # https://github.com/xdebug/xdebug/releases/tag/3.5.1
       - name: Cache Composer packages
         id: composer-cache
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # https://github.com/actions/cache/releases/tag/v4.3.0
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # https://github.com/actions/cache/releases/tag/v5.0.3
         with:
           path: /vendor
           key: php-${{ hashFiles('composer.lock') }}